← NDPA 2023 · Security

s.40 — Personal data breaches: notification and breach records

critical breach-notificationincident-response

Requirement

A processor must notify its controller of a personal data breach without undue delay (s.40(1)). Where a breach is likely to result in a risk to the rights and freedoms of individuals, the controller shall notify the Commission within 72 hours of becoming aware of it (s.40(2)), and where the risk is high shall immediately communicate it to affected data subjects in plain and clear language (s.40(3)). Controllers and processors must keep a record of all personal data breaches, their effects and the remedial action taken (s.40(8)).

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

breachpersonal data breachdata breachincident involves personal dataincident involving personal datapersonal data incident

Required element 2 — any one of

72 hourseventy-twonotifynotification

Required element 3 — any one of

commissionndpcregulatordata subjectaffected

Supporting terms — specificity signals

section 40without undue delaybreach registerrisk assessmentprocessor notifies controllertemplaterecord of all personal data breachesplain and clear languageimmediately

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no breach notification process no breach register

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.33	Notification of a breach to the supervisory authority	breach-notification incident-response
SOC 2	CC7.4	Incident response programme	incident-response breach-notification
PCI DSS 4.0.1	12.10	Incident response plan for suspected compromise of account data	incident-response breach-notification
HIPAA	164.308(a)(6)(ii)	Response and reporting (R)	incident-response breach-notification
HIPAA	164.404-410	Breach notification to individuals, HHS and the media	breach-notification incident-response
NIST CSF 2.0	RS.CO-02	Internal and external stakeholders are notified	breach-notification incident-response
GDPR	Art.34	Communication of a breach to data subjects	breach-notification
SOC 2	CC7.3	Evaluation of security events	incident-response